Skip to content

Instantly share code, notes, and snippets.

View wesinator's full-sized avatar

Wes wesinator

111 followers · 157 following
View GitHub Profile
@wesinator
wesinator / Appendix E (Digital) - MD5s.txt
Last active April 16, 2018 14:34
Mandiant APT1 appendix. https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report-appendix.zip
001dd76872d80801692ff942308c64e6
002325a0a67fded0381b5648d7fe9b8e
00dbb9e1c09dbdafb360f3163ba5a3de
00f24328b282b28bc39960d55603e380
0115338e11f85d7a2226933712acaae8
0141955eb5b90ce25b506757ce151275
0149b7bd7218aab4e257d28469fddb0d
016da6ee744b16656a2ba3107c7a4a29
01e0dc079d4e33d8edd050c4900818da
024fd07dbdacc7da227bede3449c2b6a
@wesinator
wesinator / APT1_Sophos_detections.txt
Created April 16, 2018 00:29
Sophos detections for APT1 malware - https://community.sophos.com/kb/en-us/118968
Mal/Barkio-A
Mal/Behav-001
Mal/Behav-112
Mal/Behav-116
Mal/Behav-204
Mal/Behav-363
Mal/Ecltys-A
Mal/Ecltys-C
Mal/Emogen-Y
Mal/Generic-L
@wesinator
wesinator / GORILLA.BAS
Last active January 3, 2019 15:44
Og MS QBASIC sample files
' Q B a s i c G o r i l l a s
'
' Copyright (C) Microsoft Corporation 1990
'
' Your mission is to hit your opponent with the exploding banana
' by varying the angle and power of your throw, taking into account
' wind speed, gravity, and the city skyline.
'
' Speed of this game is determined by the constant SPEEDCONST. If the
' program is too slow or too fast adjust the "CONST SPEEDCONST = 500" line
@wesinator
wesinator / APT1 - Comment Crew_ Indicators of Compromise.txt
Created April 28, 2018 05:56
Symantec Comment Crew indicators. https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/comment_crew_indicators_of_compromise.pdf
Network indicators
Network based indications of possible compromise by the comment crew attackers.
HTTP POST traffic containing
name=GeorgeBush&userid=<4 digit number>&other=
HTTP GET traffic to pages with paths:
aspnet_client/report.asp
Resource/device_Tr.asp
@wesinator
wesinator / EI.cfg
Created April 28, 2018 06:09
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-setup-edition-configuration-and-product-id-files--eicfg-and-pidtxt
[EditionID]
{Edition ID}
[Channel]
{Channel Type}
[VL]
{Volume License}
@wesinator
wesinator / AUTOEXEC.BAT
Created April 29, 2018 02:09
IBM PC DOS config
@echo off
rem ********************************************************************************
rem * Setup base environment
rem ********************************************************************************
SET DIRCMD=/O
SET PROMPT=$p$g
SET PATH=\;\DOS;
CD \
@wesinator
wesinator / number_of_bits.py
Last active May 12, 2018 17:02
Compute minimum number of bits required to represent a given integer
def number_of_bits(int):
try:
return len(bin(int)[2:])
except TypeError:
print("Error: not an integer")
@wesinator
wesinator / linguist_prereqs.sh
Last active August 3, 2018 21:51
Install prereqs for https://github.com/github/linguist/blob/master/CONTRIBUTING.md#adding-a-language (Ubuntu 16.04)
#!/bin/sh
sudo apt install docker.io
sudo apt install npm coffeescript libicu-dev ruby-dev ruby-bundler rake-compiler ruby-mocha ruby-plist pry ruby-yajl ruby-byebug
sudo gem install -g Gemfile
@wesinator
wesinator / Add_Permanently_delete_to_context_menu.reg
Created August 3, 2018 20:03
https://www.tenforums.com/tutorials/73601-permanently-delete-add-context-menu-windows-10-a.html
Windows Registry Editor Version 5.00
; Created by: Shawn Brink
; Created on: December 29th 2016
; Tutorial: https://www.tenforums.com/tutorials/73601-permanently-delete-add-context-menu-windows-10-a.html
[HKEY_CLASSES_ROOT\AllFilesystemObjects\shell\Windows.PermanentDelete]
"CommandStateSync"=""
"ExplorerCommandHandler"="{E9571AB2-AD92-4ec6-8924-4E5AD33790F5}"
@wesinator
wesinator / copy_file_intermediate.sh
Created August 3, 2018 23:39
https://stackoverflow.com/a/14085147
rsync -a myfile /foo/bar/ # works if /foo exists but /foo/bar doesn't. bar is created.